{
  "Event": {
    "uuid": "33308068-0101-4b44-8231-bb2c3431bbac",
    "info": "Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot — Optimus Labs · Civilizations",
    "date": "2025-09-06",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"salesloft-drift-oauth-supply-chain\""
      },
      {
        "name": "optimus:severity=\"critical\""
      },
      {
        "name": "optimus:type=\"supply-chain\""
      },
      {
        "name": "optimus:type=\"vendor-breach\""
      },
      {
        "name": "optimus:type=\"shadow-ai\""
      },
      {
        "name": "optimus:category=\"SC\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"AP\""
      },
      {
        "name": "optimus:category=\"OL\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.anomali.com/blog/salesloft-drift-breach-recap",
        "comment": "Anomali — chain analysis with MITRE mapping"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.upguard.com/blog/salesloft-drift-breach",
        "comment": "UpGuard — breach analysis, victim list, 700+ orgs"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know",
        "comment": "SOCRadar — disclosure analysis and exposed data inventory"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.processunity.com/resources/blogs/lessons-from-drift-salesloft-breach",
        "comment": "ProcessUnity — third-party risk lessons"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack",
        "comment": "FINRA — regulatory alert"
      },
      {
        "type": "ip-dst",
        "category": "Network activity",
        "to_ids": true,
        "value": "208.68.36.90",
        "comment": "IP: 208.68.36.90 (DigitalOcean)"
      },
      {
        "type": "ip-dst",
        "category": "Network activity",
        "to_ids": true,
        "value": "44.215.108.109",
        "comment": "IP: 44.215.108.109 (AWS)"
      }
    ]
  }
}